Hash functions may produce a hash value which is a number generated from a string of text. The hash or hash value is substantially smaller than the text itself, and is generated by a formula in such a way so as to reduce the likelihood that some other text will produce the same hash value. Hash functions may be used effectively with multi-stage filters to detect malicious content in packet communicated via a network. A packet or datagram is a piece of a message transmitted over a packet-switching network. An example of a packet-switching network is the Internet where enormous quantities of data are communicated between various network points.
An example of malicious content in a packet is data associated with viruses, computer worms, or the like. In these circumstances, it may be advantageous to identify the content in packets and thus identify the presence of these malicious viruses, worms, or the like. The content in a packet may thus have a “signature” which may identify the content and, when identified, allow appropriate action to be taken to reduce the likelihood of infection. In order to facilitate identification of the signature hash values of the signature may be used.